Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Redis Cluster splits keys across slots
Redis Cluster separates key placement from machine identity. A key maps to one of 16,384 fixed hash slots; cluster metadata maps those slots to primaries and their replicas. Adding a machine does not change the slot hash function. Operators redistribute slots, while clients discover the current topology and react to routing changes.
...
git cherry-pick re-applies a commit
Cherry-pick applies the change introduced by a selected commit to the current line of development. It is useful for a targeted backport when an older release needs one fix without the rest of a development branch. It does not move or delete the source commit, and it does not establish a merge relationship with the source branch. The target result must be reviewed as a change in its own environment.
...
Advisory lock lifetime belongs to its connection or transaction
An advisory lock lets an application coordinate work using an identifier that need not correspond to a table row. For example, workers can agree that only one connection may refresh a particular report at a time. PostgreSQL manages ownership and contention, while the application defines what the identifier means and which work requires it.
...
Accept headers let the server negotiate a reply
Negotiation selects among representations the server can actually produce. Request preferences are inputs to that decision, not evidence that the response will satisfy them. A client still needs to inspect the selected representation. Vary records the request dimensions relevant to reuse; it does not identify the chosen format, language, or compression method.
...
A cache stampede hits when expiry syncs
A cache stampede occurs when concurrent misses cause redundant work against the same dependency. Synchronized expiration is one trigger, but eviction, a cold deployment, or cache unavailability can create the same burst. A single popular key can be enough. The useful question is how many rebuilds reach the source while one result is still being computed.
...
A veth pair carries frames between two endpoints; routing supplies their meaning
A veth pair consists of two interconnected virtual Ethernet devices. A frame transmitted through one is delivered to the other, where the receiving network stack or bridge handles it. The two ends can reside in separate Linux network namespaces, making the pair useful for container networking. Creating the pair supplies a link; addresses, routes, bridge membership, forwarding, and access policy are additional configuration.
...
Security context defines constraints that need runtime evidence
A Kubernetes securityContext configures process identity and selected operating-system constraints. It can reduce what a compromised application is permitted to do, but it does not establish a complete security boundary by itself. Start with the operations the application actually needs, configure the appropriate fields, and test both a permitted operation and a forbidden one in the resulting container.
...
Protobuf compatibility changes at a JSON boundary
A schema change can be safe for binary messages and unsafe for a JSON gateway handling the same service. Protobuf’s binary format identifies fields by number; ProtoJSON normally exposes their names. Review compatibility as a matrix of producers, consumers, and transformations. A successful compile or one pair of compatible endpoints does not prove that every relay preserves the information they exchange.
...
